NEAS[.]e7b7406af8fc4b60619c3d36e9834ca0[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.e7b7406af8fc4b60619c3d36e9834ca0.exe
Size

1.3MB
MD5

e7b7406af8fc4b60619c3d36e9834ca0
SHA1

7f2ddb532cfae380242be6a3201c2aff27c637fe
SHA256

257a5cc65b21d3652d3fe174c91ea184a05b1151e52b208a0e1a86f0ee976250
SHA512

e861a8bd4b62a1f5c2c9330466dda3ee513cecfc3f224ecf8c360a734c12f7bde999481b34fa4f28057ca04428457e97aa84774ad67cef054ae70d22647207b2
SSDEEP

24576:jyzaHsK+fM2jEaNZBqoeW7V6tGLfHtqls+0:j4ksDM2jh3BqS7YtGL/Als

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.e7b7406af8fc4b60619c3d36e9834ca0.exe

Files

NEAS.e7b7406af8fc4b60619c3d36e9834ca0.exe
.exe windows:6 windows x64

364ce282a93e03a146321d365523e1d1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetCommandLineW
TlsGetValue
UnregisterWait
TlsFree
TlsAlloc
LocalAlloc
ExpandEnvironmentStringsW
SetFileAttributesW
LocalFree
DeleteFileW
DeleteCriticalSection
FindNextFileW
IsDebuggerPresent
LockResource
FindClose
GetModuleFileNameW
GetExitCodeProcess
FormatMessageW
GetCurrentThread
CreateDirectoryW
LoadLibraryExW
CreateProcessW
LoadResource
FindResourceW
FindFirstFileW
GetThreadContext
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
Sleep
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetFullPathNameW
FreeLibrary
SetEvent
WaitForSingleObjectEx
OutputDebugStringW
QueryFullProcessImageNameW
CreateEventA
CreateFileW
GetLastError
GetProcAddress
ResetEvent
GetLocalTime
LoadLibraryA
QueueUserWorkItem
CloseHandle
DebugBreak
GetSystemWindowsDirectoryA

ole32

CoCreateInstance
StringFromGUID2
CoGetObjectContext
CoInitializeEx
CoUninitialize

msvcrt

__CxxFrameHandler3
??1type_info@@UEAA@XZ
_wfopen
memcpy
_CxxThrowException
memset
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_fmode
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
_purecall
_commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
free
_callnewh
malloc
wcschr
_wstrdate
_waccess
_wstrtime
_wcsicmp
_vsnwprintf
fwprintf
fflush
fopen
fprintf
fclose
wcsrchr
_local_unwind

msdtctm

ord4

ntdll

RtlReportException
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

version

VerQueryValueW

user32

GetWindowRect
GetThreadDesktop
CloseWindowStation
DialogBoxParamW
GetProcessWindowStation
OpenDesktopW
GetClientRect
SetProcessWindowStation
EndDialog
GetDesktopWindow
SetWindowPos
SetThreadDesktop
SetDlgItemTextW
OpenWindowStationW
MapWindowPoints
LoadStringW
CloseDesktop

advapi32

RegOpenKeyExW
GetTokenInformation
OpenProcessToken
RegSetValueExW
RegCloseKey
ReportEventW
RegisterEventSourceW
RegOpenKeyExA
DeregisterEventSource
RegQueryValueExW
RegQueryValueExA

Sections

.text
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

364ce282a93e03a146321d365523e1d1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ole32

msvcrt

msdtctm

ntdll

version

user32

advapi32

Sections

.text Size: 39KB - Virtual size: 38KB

.data Size: 1KB - Virtual size: 10KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 94KB - Virtual size: 94KB

.reloc Size: 1.2MB - Virtual size: 1.8MB

.text
Size: 39KB - Virtual size: 38KB

.data
Size: 1KB - Virtual size: 10KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 94KB - Virtual size: 94KB

.reloc
Size: 1.2MB - Virtual size: 1.8MB